Yara Rules error

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Yara Rules error

L2 Linker

Hi,

 

Trying to use yarascan automation from yara pack on marketplace, always receiving "HasMatch: false"

 

Here it goes the printscreen with the command and the contextdata showing the entryid

 

FabioFerreira_0-1679411632399.png

 

The content has that rule

 

FabioFerreira_1-1679411743582.png

 

Could you help?

 

Regards,

Fábio

 

 

1 accepted solution

Accepted Solutions

L3 Networker

I think the issue here is the arguments. 

 

The yaraRule parameter is supposed to be a raw YARA rule, and the entryIDs parameter is a list of files to evaluate with the yara rule. (ie, the files which may or may not match a rule) In normal usage I wouldn't expect any of the entryIDs to be a .yar file, and the rule name on it's own will not compile as a valid yara rule.

 

If you need to use arbitrary rules inside yar files you'll need to read the data from the yar file first, then pass it to YaraScan eg with a wrapper script.

View solution in original post

4 REPLIES 4

L2 Linker

In the context I see the yara file, What you are trying to accomplish is scan a file with a YARA rule to figure out if it matches right?

 

Try with the below YARA rule. This will come true for any file. 

 

rule match_any_file { condition: true }

 

Let me know if it works, we'll try to troubleshoot further

L2 Linker

Hi,

 

I changed the yara file and added the following

 

FabioFerreira_1-1679482569709.png

 

 

And tried again with the same issue

 

FabioFerreira_2-1679482960134.png

 

 

Regards,

Fábio Ferreira

 

 

L3 Networker

I think the issue here is the arguments. 

 

The yaraRule parameter is supposed to be a raw YARA rule, and the entryIDs parameter is a list of files to evaluate with the yara rule. (ie, the files which may or may not match a rule) In normal usage I wouldn't expect any of the entryIDs to be a .yar file, and the rule name on it's own will not compile as a valid yara rule.

 

If you need to use arbitrary rules inside yar files you'll need to read the data from the yar file first, then pass it to YaraScan eg with a wrapper script.

L2 Linker

Hi @chrking ,

 

Got it.

Thank you for your help.

 

Regards,

Fábio Ferreira

  • 1 accepted solution
  • 1680 Views
  • 4 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!